Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

bonch writes "A massive Android malware campaign may be responsible for duping as many as 5 million users into downloading the Android.Counterclan infection from the Google Android Market. The trojan collects the user's personal information, modifies the home page, and displays unwanted advertisements. It is packaged in 13 different applications, some of which have been on the store for at least a month. Several of the malicious apps are still available on the Android Market as of 3 P.M. ET. Symantec has posted the full list of infected applications."

I've always thought it was odd that those games that literally copied Counter-Strike were allowed on the Google Market.

I know, you're about to say "copying gameplay, while unethical, is completely legal". Problem is, they didn't copy the gameplay - they're boring rail shooters. The copied stuff is the art - the textures, models, even some of the maps. And that's blatant copyright infringement. It's obvious even from the previews, if you've played the game enough. And since, at one point, people playing cs_italy were responsible for more bandwidth usage than actual people in Italy, I'm pretty sure I'm not the first to notice it.

I figured Valve, being pretty savvy about this sort of thing, figured that suing them would give them too much publicity - Streisand Effect and all that, not worth the huge amount of publicity that anything Valve does. Now, I'm thinking that iApps7 was just ignoring the cease-and-desists, because when you're already distributing malware and committing actual, commercial copyright theft, you're probably not too afraid of lawyers.

Although I seriously doubt Symantec's 5 million number is right, the fact that malware keep showing up on the market is disturbing. Actually, we're beyond disturbing, it's getting downright annoying. Google needs to do better than removing bad applications after the fact, and while this doesn't need to be a Jobsian walled garden, at a minimum Google needs to start reviewing all applications (and updates!) before posting them to make sure they're clean.

Phones are appliances, and trying to handle malware the same way we handle it on computers (which is to say, after the fact) is not going to work.

What they could do is provide the same sort of "reviewed application" market that Apple does, but as an option (as I believe Apple should). I see that as the best of both worlds. If you want to lower the odds of malware, use that market. If you don't mind a little risk use something else, like the current Android market.

I'd also like to add that my phone is no more an appliance than my home computer. Some phones are appliances because their functionality has been reduced to that. I'm still hoping for an updated version of the N900 (or something similar) to hit the market.

Nerds seeking a feeling of control in their lives turn to computers. They hate the idea of appliances, because the feeling of mastery over something gives them a sense of control that they lack in their daily lives.

I think some of the Apple hatred stems from the fact that many techies absorb themselves in computers because it gives them a feeling of control that they lack in their daily lives. Mastering a system is gratifying on many levels.

I think the cause of reactions like yours is that some people don't have control in their lives, so they seek it in PCs, because mastering the upkeep required for a PC gives you that missing feeling of control. Having that feeling taken away from you by non-PCs threatens you on a core level, reminding you of the lack of control in your real life, so you snap back to protect it.

Nerds seeking a feeling of control in their lives turn to computers. They hate the idea of appliances, because the feeling of mastery over something gives them a sense of control that they lack in their daily lives.

I think some of the Apple hatred stems from the fact that many techies absorb themselves in computers because it gives them a feeling of control that they lack in their daily lives. Mastering a system is gratifying on many levels.

I think the cause of reactions like yours is that some people don't have control in their lives, so they seek it in PCs, because mastering the upkeep required for a PC gives you that missing feeling of control. Having that feeling taken away from you by non-PCs threatens you on a core level, reminding you of the lack of control in your real life, so you snap back to protect it.

You don't even really try, do you?

Thanks for that. I thought that I had heard that sentiment on Slashdot a couple of times and it was bugging me.

I presume you are in the 4% then? Most people do control their gears - just not in the USA. Canadians please comment. I don't know if you have allowed the US motor industry to remove control of your cars from you as well,

And I have to say, lying in bed with a computer that does all the things I and most people in the world use them for--browsing the web, casual games, watching movies, posting on social networks, listening to music--without all the maintenance and time investment of a girlfriend is really, really nice.

I have encountered all of a handful of users with tablets and each has said basically the same thing.

With a sample size like that, how could you be wrong?

For crying out loud, we're onto year three of the iPad, and it sold over 15 million last month. This is as much a "fad" as the mouse and GUI. If you don't see the inevitability of this, then frankly you are out of touch. Nobody wants to install and maintain a PC just to browse the web anymore. The same kind of streamlining already happened to gaming in the

When netbooks came out they delivered remarkable utility with long battery life in a tiny package for low cost - using Linux and small SSD media. The netbook met a need for low-cost compromised UI with good performance. Then Microsoft convinced all the Linux netbook vendors to convert back to XP, consuming more storage (and driving the cost up) and delivering less-adequate performance. They sold more units, and lost money on every one. And then there was the crippled versions of W7 thing with even higher costs as the cost of full laptops dived below the price of netbooks. And the netbook market crashed because nobody was going to go back to the cheaper, quite awesome Linux variant when they could sell $300 laptops instead. But a funny thing happened. The price of a laptop also fell in response to this netbook threat - from $900 to under $300. Microsoft successfully killed the netbook by cutting the throats of their PC OEMs with budget laptops.

People forget that between the netbook and the tablet was a Smartbook - invented by Asus and showed briefly in 2009 at a summer trade show - and then suddenly yanked in mid show. It was a ARM/Linux platform. The very next week a very nervous looking Jerry Shen flanked by Steve Ballmer and a member of Microsoft Legal was talking up Asus W7 platforms on a stage in Taiwan. He seemed to be sending out very stressed body language - something like "help me".

So now we have ARM tablets, mostly thanks to Apple's huge margins and lack of commitment to the Windows ecosystem enabling them to innovate. But the netbook story isn't going to play out here again. The CE vendors are in this game now and Microsoft doesn't have the leverage over Samsung and HTC that they had over the PC vendors. The CE vendors can't make Apple tablets: only Apple can do that. So they're going to do the thing they CAN do, and make Android tablets as best they can. And they do. And they rock. And Google does the ecosystem thing for them, with 250M units in the field the developer need not worry about there being a market for his app if it's any good. With hundreds of thousands of apps customers need not fear the thing won't do what they want - in fact, if you've bought it for your phone you don't have to buy it again for your tablet. And some of the apps - particularly games - are quite incredible on a device with all-day battery life. And things like Kindle app of course still give you access to all the things you've bought through there too.

The new crew, the CE giants, the Samsungs and HTCs are also the ones burned on Windows Phone and buying back their stock thanks to Nokia's preferred standing - so they're not going to push for WoA. Neither are the PC OEMs, once they find out Nokia got early access and help, and they're required to include software with Nokia branding on it in their PCs.

WoA is going to try to step into this with no apps, a rejected WP7 UI and a general distrust of Microsoft, and try to make a go of it. Maybe even without multicore. They're going to have to acquire HTC to make that happen, because without something on that scale they got nuthin.

The problem with the Apple market, and with your idea too, is that it is predicated on having an answer to the second question other than "nobody".

It seems clear to me that a better solution could be built around the first question. That entails letting the consumer decide who he trusts to review and approve apps, then giving him the tools to implement that trust. That'd involve some kind of network to distribute digitally signed approvals. You wouldn't have to have different app stores. You could use any store or combination of stores you wanted. What matters is whether you can find a certification for an app from an authority you trust.

Consumers would subscribe to different authorities based on their concerns. Businesses might choose different kinds of reviewers to trust than gamers. Different functions in a business might choose different reviewers based on the kind of information they handle (e.g. whether the device running the app has sensitive or privacy related data). Evangelical Christians might choose review authorities that reject apps that promote pornography, and porn-hounds would choose authorities that reject apps promoting Christianity.

That assumes that the average consumer can or should be able to make intelligent decisions about "who he trusts to review and approve apps". In reality it would be the malware company with the biggest marketing budget. The idea that a consumer should first spend weeks getting up to speed in the mapping or racing simulator communities before they can safely try out a couple apps is ridiculous. What you would get instead is friends recommending friends, and all that means is that every person who gets tricked they immediately recommend a few friends to download the same BS.

Because the question in question is not "who can *everyone* trust?", the question is "who can everyone trust not to serve up malware". That is a much easier question to answer. And I think "big company with a lot of resources and a large vested interest in not serving me malware" is a pretty good answer to that question.

That assumes that the average consumer can or should be able to make intelligent decisions about "who he trusts to review and approve apps".

Not really. It assumes *some* consumers are able to make intelligent decisions and that there is benefit to addressing their needs and costs to sweeping them in with consumers who are less savvy. By that reasoning, there should be no *Consumer Reports* and we should rely upon the Consumer Products Safety Commission to make decisions for you.

In reality it would be the malware company with the biggest marketing budget.

This is probably depends on the *kind* of malware. Take privacy intrusion. Privacy intrusion for collecting marketing data would surely be a problem, because it's legal. But it goes on anyhow, you just don't see it and it's not running on your equipment. The point of entry to the surveillance network is the retailer. Privacy intrusion for purposes of identity theft would not be a problem *for the certification system* because the "big marketing budget" provides a trail back to the perpetrators.

The idea that a consumer should first spend weeks getting up to speed in the mapping or racing simulator communities before they can safely try out a couple apps is ridiculous.

I'll ignore the various shortcomings of the scenario you propose and cut to the chase: The real issue with the system I proposed is that it cannot overcome impatience, and it conflicts with the needs of marketing, which exploits impatience. There's an app that's gone viral, but it hasn't been certified yet by anyone you've heard of. It might take weeks for the stodgy certifiers everyone uses to get around to examining the thing, during which you'll have to live without this app you feel you can't live without. So you choose to grant an exception, or worse -- to trust a dodgy certifier. In fact, the system I proposes creates a new avenue for social engineering attack in which malware authors entice consumers to trust a malicious certifier because they want their free game *right now*.

So why do I think it's a good idea? Because my standard of success is different than yours. You want a system that will protect foolish people from their choices. I want a system in which it is *possible* to make and enforce good decisions. While I think it is unfortunate that fools are exploited, I see no way of protecting them absolutely without posing unreasonable restrictions of freedom.

Because the question in question is not "who can *everyone* trust?", the question is "who can everyone trust not to serve up malware".

Well, if you can answer that, you make those agents the *default* trusted authorities. The problem I have with platform-vendor-chooses-who-everyone-has-to-trust solution is that everyone is not the same. A hospital securing its mobile devices used in health care delivery is different from a teenager who is messing with his game console. People feel differently about privacy too, and their stance may vary depending on device. That teenager might choose different universes of apps for his game console and phone.

The problem with the current system is that it relies on people being able to draw inferences about developer intent from specific permissions an app requests. How insane is that? Even an expert who understands what a permission *does* can't reliably anticipate everything it can *accomplish*, much less the *intent* of the developer in asking for it.

I've always thought that apt (apt-get, aptitude, Debian) has the right solution to this.

You get your software from a repository, and only software that is approved by the maintainers of the repository gets in.

Then, _you_ get to choose which repositories you trust.

That way, you don't have to judge the quality of all software yourself. You can leave that to the people who maintain the repositories. They will build up reputation over time, and you can go with the ones that have a good enough reputation by your standards.

A walled-garden app store like Apple's basically implements the first part of this. This is fine for a lot of people.

To also cater to those who want more freedom, without opening the flood gates, all you have to do is allow them to shop at other app stores, as well.

The problem is that a lot of people (most?) would find apt-get horrendous. App stores are simple way to let someone else decide for you what you want.

Even most Android users are probably quite content with one market place. You may have more than one. Most users here may well have installed things straight from an.APK file. This is not normal. We here should not take our attitudes and abilities as the norm.

The only problem I see with that is that it doesn't do much to solve the Dancing Bunnies problem within the Market. So long as loading unsigned applications is allowed it will always be an issue, but not allowing unreviewed applications at all in the Market is a much better solution. Otherwise people are going to grab their Counter Strike knock-offs whether they're reviewed or not, because after all they're coming from Google and Google can be trusted.

What they could do is provide the same sort of "reviewed application" market that Apple does, but as an option (as I believe Apple should).

The nice thing about the Android mindset, is that this can be done. Anyone who wants to can setup such a service. If there isn't such a service, then it's just a demonstration that there isn't sufficient demand for such a service - at least, there's not sufficient demand to cover the additional expense of such a marketplace. It's a very free-market approach.

In a way, you already have that. Appbrain accepts more risk than does google. As such, once you use appbrain, you have more risk. But the idea of a market with nothing but reviewed apps is a WONDERFUL opportunity for new companies. Right now, it is either all google's market or allows all else. But, if they would allow for other markets to be accepted that are considered more secured than Google's current market, then it would be possible to have multiple companies reviewing these apps. In particular, and

I think the default Android Market should be a "reviewed application" market. Android does allow you to side-load apps and use other App stores, so for that reason, it wouldn't be censorship in the same way that the Apple App Store is.

foxconn factory workers very satisfied: 100%, with no dissent! amazing.

when interviewed, every last worker expressed their deepest appreciation for their bosses, and how much they love working together for harmonious success of the company, which they love and admire deeply.

foxconn factory workers very satisfied: 100%, with no dissent! amazing.

Who makes your Android phone?

Some company that cares even LESS for their workers. At least Apple is trying to help and improve things, but China has a very servile culture embedded that has been pushed on them for many generations. They have a factory culture that has been as it is for a long time now and change is not instant.

So every dig you take at Apple and Foxconn labels you a dirty hypocrite if you use any electronics whatsoever, because even more people suffered for your device to be made...

HTC makes all of their premium Android phones in Taiwan. The workplace standards are of course much higher there compared to Mainland China. Samsung, on the other hand uses a number of factories, including ones in South Korea and China to make their flagship Galaxy SII phones.

HTC makes all of their premium Android phones in Taiwan. The workplace standards are of course much higher there compared to Mainland China. Samsung, on the other hand uses a number of factories, including ones in South Korea and China to make their flagship Galaxy SII phones.

I just checked my Galaxy Nexus. It says "Made in China", so I'm guessing it's probably a safe assumption it's made at Foxconn.

And while HTC's premium flagship phones are made in Taiwan, I'd guess most of the rest of them are made in Fo

Foxconn is the world's largest maker of electronics components and makes products for every major computer company including Dell, HP, Microsoft, Nintendo, Samsung, and Sony. Why they're always intimately associated with Apple on tech forums is beyond me other than as anti-Apple flamebait.

Adding a walled app garden wouldn't even begin to fix the quality control issues with Android. First you have the wild variety in smartphone quality. Sure, you get Android in more people's hands with cheaper phones, but the experience suffers and those people end up unsatisfied. Then you have the situation where a brand new phone can be released with an old OS. Looking over AT&T's Android lineup, it seems like almost 50% of their smartphones are stuck on 2.2, and will never see another upgrade. It also

That's if you want to prioritize satisfaction over all else. Paradoxically reduced choice can lead to greater satisfaction [ted.com] even if it leads to lower productivity. While customers may be seeking to maximize satisfaction for personal use, I daresay most businesses would choose to maximize productivity, or bang for the buck. While libertarians (both the right wing and left wing types) would choose to maximize choice.

Walled garden is the way to go.Android users very satisfied: 47%iPhone users very satisfied: 75%

Nokia and RIM had walled garden. What's the stats with those?

Besides, even if Google copied the Apple App Store tomorrow, it would still have Android on a wide variety of devices, both low end devices and high end devices, so that rating would still be unlikely to change. The same goes for the iPhone. If Apple were to suddenly target the low end of the Market, I doubt any of the customers with the lower end devices vs. the high end would be as satisfied.

False. The walled garden is about trapping users and forcing them to a sole source.

What Google needs to do is start vetting and being more stringent about what gets into the store. Taking away people's ability to side load (which is what the Walled Garden is about) does nothing to further this.

Although I seriously doubt Symantec's 5 million number is right, the fact that malware keep showing up on the market is disturbing.

To be fair, this does not look like Malware at all.

For instance, I'm looking at the game called 'Balloon Game' by Ogre Games, which they say is malware. By downloading the application, you're agreeing to the fact that it can read your phone state and phone identity, you're agreeing that it can use the internet, and you're agreeing that it can install shortcuts on your home screen.

The application wants to know my unique IMEI number? or my Mac address? Whoop di doo. I really don't care about that. And yes, it has access to the internet, so it can serve me ads, send info about me, and possibly (according to Symantec) update its own code in real time.

But even if it can update its own code in real time, it can't change its permissions in real-time (it doesn't have the permissions for that), so it's still sandboxed in the permissions I gave it originally. So what's the problem here? What other "sensitive" information is it leaking out? Does this application go against anything in the Google's Market Terms of Services in any way? No, it doesn't. Only Apple has inane Terms of Services about not being able to load code dynamically from the internet.

Perhaps Symantec are flagging it as malware because it is using permissions that the app clearly does not need, and it is just some rookie developer that has permission code copied in from some other site?

Perhaps Symantec are flagging it as malware because it is using permissions that the app clearly does not need, and it is just some rookie developer that has permission code copied in from some other site?

No, it's flagging it as "Malware" because it wants to you do the following [symantec.com] as their solution for removing the so-called "Malware". Note how they conveniently left the simplest instructions for uninstalling the application all the way at the bottom of the page (where almost no one will see it).

Perhaps Symantec are flagging it as malware because it is using permissions that the app clearly does not need, and it is just some rookie developer that has permission code copied in from some other site?

For years, the Windows platform was mocked relentlessly as a cesspool for malware. It's interesting to see what happens when there is a lack of quality control from the platform vendor, which turned Windows into a complete mess of contradictory interfaces (even within Microsoft's own software), convoluted configuration settings, and a third-party market devoted to cleaning up viruses and spyware. Android seriously risks going down that path, if it's not there already. There has to be more control on the part of Google.

Pushing back on that is a small contingent of techies who want to turn the smartphone into a PC. They like to cite the freedom to install anything they want, but the truth is that mainstream users wouldn't do so even if they knew how. Google needs to cater to the needs of the majority and not latch onto populist concepts sound good to tech crowds (e.g., "openness") but mean nothing to everyone else who just uses these things as tools rather than hobbies--especially when Google seems to have trouble following fundamental tenets of open source like source code access.

Those 37 million iPhone sales over December reversed the 2011 Android surge. The in-fighting among Android vendors risks more forks like Kindle Fire, customized interfaces, and abandoned phones that no longer receive updates mere months after their release. Google, turn the ship around before it's too late! The carriers won't help you.

You've all been fooled. Before you forward the Symantec scareware to all your friends, please study what the symantec announcement says a little more closely.

I've taken a look at the 'Balloon Game' by Ogre Games for instance. It's not malware. It's not doing anything that it hasn't requested in the permissions already. And even if it can update itself (as Symantec claims it can do), if you read Symantec owns report, Symantec doesn't think it can do anything (outside of the permissions it has already been gr

No, I meant the home screen, not the home page. On Android, you have a home screen, which an app can add its shortcut to (assuming it's not full, if it's full, it's out of luck, and the shortcut doesn't get made). And yes, there are plenty of people who don't want ads and who don't want to be tracked.

On the Android Market, those people will usually have to pay to buy a version without the ads (and/or install a custom rom with the ads sdks disabled). There are still free apps with no tracking and no advertis

Apart from being somewhat annoyed about the greater difficulty of managing my smartphone when compared to my Linux boxes, I've been having a hard time selecting apps for it.

Android market is not exactly friendly (is there a way to get larger fonts?) and I'd like to have a search by permissions. Recently, I wanted a mere notepad app -- no frills, no cloud, no nothing, just the note, but there's an "excellent" notepad app which requires you to join an online service. WTF!!!

After finding 2 suitable apps, I would still need a bigger keys soft keyboard... again looking at permissions to avoid leaking unnecessary things.

No wonder guys end up getting viruses... we need better ways to control our exposure. Then again Google's business depends on offering us what we want and thus they need to know that. But am I giving my data only to Google? I wonder where my accounts and their details end up going...

You miss the point.
He wants to be able to make a simple search based on permissions. That is actually a valid one. For example, the idea that Sony's remote controller for a blu-ray player requires permission to read my personal info and to read-write is a good sign that you do not want it. It is simply a data gathering app. IOW, Sony did not learn their lessons from their last attempt to do this to Windows.

The font is minor, just an annoyance. the permissions based search is ALL about security.

Well, combine this with Googles recent news of privacy policy changes and Android's shine really is fading fast. I hate Apple, not for the products, I love Macs. It's the overused domination attitude I just can't deal with. So, that said, what's left? Win phone? Omg no. Maybe RIM and Nokia still have a niche after all... Just something to consider.

What does their attention to detail have to do with their domineering attitude?

Apple's products are all "our way or the highway", and use lock-in to try and keep people in their eco-system. It's stuff like that that the OP was complaining about, not the quality of their products.

Seriously, this is an opportunity for a company to come up with a new market to compete against Google. Basically, set it up similar to Apples: submit the app, have it tested, etc. and charge a small amount of money. For me, I will stay with google. BUT, for my parents and in-laws, they would go with the secured market.

'Symantec estimated the impact by combining the download totals -- which the Android Market shows as ranges -- of the 13 apps, arriving at a figure between 1 million on the low end and 5 million on the high. "Yes, this is the largest malware [outbreak] on the Android Market," said Haley.'

'Symantec estimated the impact by combining the download totals -- which the Android Market shows as ranges -- of the 13 apps, arriving at a figure between 1 million on the low end and 5 million on the high.

Of course Symantec totally ignored that the download totals do not translate into the number of infected users. How many devices have multiple apps? That estimate could easily be 10x too high.

Did the author run scripts to pump up the numbers to gain visibility? Many app authors do this

And there's a (probably small) number of users like me, who will occasionally install something against my better judgement that I need for a one time use... and I neuter the permissions with things like DroidWall, LBE Privacy Guard, Permissions Denied, and others... and I think CM7 included its own permissions control.

BTW: Symantec is just now disclosing that their servers were hacked [huffingtonpost.com] in 2006 (as far as they know - maybe earlier). They don't know how long the hackers have PWNed their network, how much control they had, or for how long - but they're quite sure the hackers have stolen some of their source code. They recommend that you not use / disable / uninstall some (most) of their software. Most especially including PC Anywhere, since apparently it has a vulnerability or "back door" that allows the hackers to remotely administer your PC from Anywhere - and has for the last SIX YEARS.

I think I'm going to take Symantec's edicts with a grain of salt from now on, even if this is from a different group.

Their low end needs to be divided by 13, as it is possible (though unlikely) that all users that have downloaded these apps have downloaded all 13. And then there are the users who wipe their phones (perhaps because they saw malware symptoms) and redownload. So probably the reality is anywhere between 50,000 and 5,000,000 infections.

This is what I came here to say. If you think that those apps are legitimate or at least only a positive, you are either very desperate, underage, or a moron of the highest order. In the case of the first, I'm sorry you don't have the brains to find actual free porn/cheesecake pics, in the case of the second you're not clever enough to ascend to the next level of porn, and in the case of the third your phone is too smart for you, please take it back.

On a slightly different topic, since I might as well go all out in insulting average non-computer-savvy people for the crime of not spending their life like pasty-faced Anonymous Cowards in front of the cool glow of a monitor in their basement, I remember an early app in the Android market that was literally a tithe calculator. I'm GUESSING this was someone's first app or otherwise a test app by someone learning to program, because I actually downloaded it a second time after an update and the interface became slightly more refined (with a background picture instead of a flat colour and so on), and I'm not particularly here to mock the author of the app so much as any target audience members that might exist.

The app had a prompt for you to enter how much your annual income was, and then a 'go' button that returned (income/10) as the amount you needed to tithe. In the event that you belong to a church that receives tithes to support it, I'm very afraid if you need a smartphone and a custom app in order to divide a number by ten. The app did exactly what it said on the can, but by FSM I hope nobody was browsing through the Android Market and went "Oh! That's exactly what I need!"

...I'm very afraid if you need a smartphone and a custom app in order to divide a number by ten....

Ok, granted you are correct, but you also downloaded it... TWICE! I haven't downloaded any of the apps mentioned, and they look like crap apps I would never pay for, but I can't claim I've never tried out some free simple thing cause I was curious, as I'm guessing was the case with you. Now, if that tithe calculator required access to your phone book, net access, phone status, location data, etc, then it's stupid to install it... but then it gets into the realm of the user being able to interpret the secu

I'm not sure how, but you've hit the crux of it. With Windows, we expect this "blame the user" scenario because we've been trained to expect it. We were hoping for better with Android. But there are just so darned many apps now to vet.

Maybe a second level of "hey, these permissions are really loose and align with known malware. Are you really sure you want to enable this app to upload all your files and your contacts list to any random website and dial 1-900 numbers to run up your phone bill?" consent might be required.

Or maybe just triggers for additional inspection of apps based on required permissions. But that costs money, and somebody has to pay for that. Maybe a permissions cost matrix for uploading your app, to pay for the code inspection. That would encourage developers to require the minimum necessary permissions.

Wouldn't it be fucking nice if it only could have unchecked internet access to an explicit list of URLs and "full internet access" meant "initiated by user action"?

Same for file system and for "Read phone state and identity" - 95% of apps in the market want the same permission.

It just gets devalued, like UAC's very helpful and informative "Allow this program to make changes to your computer?" prompt (More details? Sure: "Origin: Hard drive on this computer"). With all kinds of "changes" and their frequency it's not hard to see why UAC is often turned off. WIth all kinds of "full internet access" it's not hard to see why permission page is just to click "Accept".

She can. Why shouldn't she? It's not like there are no bad URLs outside apps. It should be as much common sense as knowledge of mail frauds and con tricks.

Delegating vetting of apps behaviour to end users is a fundamentally bad idea. It's a task that requires skills and experience, and you can't assume them in a consumer product. This is stuff that should be done by professionals in the supply chain.

May be, though I, like many others, prefer choice. But why does that invalidate a need for better permission system? AFAIK, iOS basically permits applications to do whatever they want with internet, relying on vetting to weed out abuse - and it's not guaranteed to work. There already was a handful of examples, like Dolphin browser quietly sending every URL you visit to their server "to check compatibility with Webzine"

You seem to be opposed to it only on "iOS approach good, Android approach bad" basis. I don't see anything wrong with requiring basic knowledge from smartphone users. Is "Don't install games that want to send paid messages on your phone" so much harder than "Don't put metallic tableware in the microwave"?

I don't think Android's permission model is very good (it should allow some actions like making calls / SMS / root to be user vetoable) but the fact it has permissions is still better than nothing. When a free "sexy women puzzle" is asking permission to make calls or send / receive SMS messages then if you have a lick of sense you won't install it.

I've had this argument on/. a thousand times. There's a reason why NetBSD isn't popular. They have a certain philosophy that security isn't something you compromise on to deliver usability or popularity. They don't implement a feature - any feature - unless it can be secured. They don't listen on ports by default. They don't auto-execute anything on mounting, and so on - because these features, while popular, compromise security. It's a religion with them. They've had some lapses but AFAIK no curren

Of course, everyone has known for the past decade at least that we're at the point where the primary attack vector for malware is social engineering. It's only really on Slashdot and other Linux-cebtric sites where you still see only a half admission of that fact. It's social engineering when it affects Linux, whereas it's shitty inherently shitty security when it affects Windows,

At least we can finally stop pretending that Linux is powered by MagicalPixieDust(TM) and is immune to infection.

No. We should stop pretending that OS and application design choices don't matter. They can't stop everything but they can avoid the sort of nonsense that happens in Windows. When it comes to "social engineering" in Windows, the bar is simply much lower. No degree of self-delusion on yoru part will change that.

You can be smug when Android or iPhone or Linux or MacOS has the same sort of "browse this webpage get infected" problem that Windows has.

Slashdot is intentionally not providing you full tech news coverage because it caters to a specific demographic of emotionally-invested users who are more likely to generate repeat page views.

Slashdot is a business whose sole income is advertising revenue. People visit because people visit. The Slashdot business model (Soulskill is an employee) is to promote controversy - The Rupert Murdock Model®. It ceased to be anything./ related a long time ago.